End-to-end communication connections such as those conducted between a client and a server can often be optimized for more efficient and/or rapid transit across a WAN (wide-area network) or other long-haul communication link, such as the Internet. Such optimization is typically performed by a pair of transaction accelerators installed within the path of communication, wherein the accelerators manipulate communications as appropriate to reduce the amount of data that must be conveyed.
For example, a transaction accelerator such as that described in U.S. Pat. No. 7,120,666 (McCanne) can offer performance improvement for 25 operations across a WAN when the data being communicated is either intelligible (i.e., the transaction accelerator can interpret at least parts of the protocol) or repeating (i.e., identical data crosses the network in identical format).
Illustratively, a client-server connection (or other end-to-end communication connection) may be split-terminated at the accelerators, with one of the accelerators receiving messages from the client, manipulating them and forwarding them to a cooperating accelerator. That accelerator processes the communications (e.g., to recover the original messages), then forwards them to the server. Communications passing in the reverse direction are processed similarly. Thus, the overall client-server connection is split into multiple separate sessions.
However, the manner in which transaction accelerators configure their optimized communications may impact other aspects of an organization's networking environment. For example, a transaction accelerator may use its own network address when communicating with another accelerator, but an address of the server or the client when communicating with the client or the server.
More specifically, an accelerator that receives messages from a client may proxy for the server to receive messages directed to the server and to deliver to the client messages originated by the server. Likewise, the other accelerator may proxy for the client to exchange messages from the server. Between themselves, however, the accelerators may exchange optimized communications using their own network addresses.
This scheme usually frustrates an organization's desire for network transparency, which would allow the organization to track communications throughout its network and attribute them to the appropriate endpoints (e.g., client and server). If the organization cannot track communications from one end to another, they may be unable to effectively monitor their network traffic, determine the effectiveness of the transaction accelerators, promote desired Qos (Quality of Service), ensure effective load-balancing, and so on.
However, enabling network transparency is not as simple as using the network addresses of the client and server throughout the split-terminated sessions established by the transaction accelerators. For example, each time an accelerator receives a request from a client for a connection with a server, it must determine whether there is a cooperative accelerator available in the vicinity of the server. If not, the connection cannot be optimized and the client and the server should be allowed to communicate as they would without transaction accelerators.
However, if there is an available server-side accelerator, then the accelerators can perform their optimization. But, they must configure their communications to avoid any possibility of corrupting other data passing between the endpoints. For example, if the server-side accelerator were to fail, communications directed to it from the other accelerator would then be received directly at the server. If the accelerators' communication session could not be differentiated from other connections, the endpoint may accept their data within a different connection and suffer from data corruption.
Further, if a stateful firewall is interposed between the transaction accelerators, their ability to open multiple communication sessions using the same network addresses may be limited. For example, if the accelerators use addresses of the client and the server in order to promote network transparency, a firewall may deny any attempt to open a second connection between the same pair of addresses while a first connection is still open.